Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency update on pac-resolver vulnerability? #38

Open
sirmisteryflavor opened this issue Jan 2, 2022 · 0 comments
Open

Dependency update on pac-resolver vulnerability? #38

sirmisteryflavor opened this issue Jan 2, 2022 · 0 comments

Comments

@sirmisteryflavor
Copy link

Hi, when I run npm install for multer-storage-cloudinary, I get the following warning.

npm install multer-storage-cloudinary

up to date, audited 202 packages in 4s

8 packages are looking for funding
  run `npm fund` for details

4 high severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

I then run the npm audit and the message below is printed. Seems like the fix is to install [email protected]. Will this be implemented? Or should we individually fork and do it manually? Thank you! Learning npm slowly so any suggestion/advice is greatly appreciated.

# npm audit report

pac-resolver  <5.0.0
Severity: high
Code Injection in pac-resolver - https://github.com/advisories/GHSA-9j49-mfvp-vmhm
fix available via `npm audit fix`
node_modules/pac-resolver
  pac-proxy-agent  <=4.1.0
  Depends on vulnerable versions of pac-resolver
  node_modules/pac-proxy-agent
    proxy-agent  1.1.0 - 4.0.1
    Depends on vulnerable versions of pac-proxy-agent
    node_modules/proxy-agent
      cloudinary  >=1.28.0
      Depends on vulnerable versions of proxy-agent
      node_modules/cloudinary

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant